Smartcards, and other electronic devices used for security purposes, are vulnerable to analysis of power consumption in order to extract secret data [4, 5, 12, 14]. This technique, known as power analysis, can reveal a lot of information about the work being done by the electronics, including the Hamming weights of signal transitions on the buses and the instructions being executed. If circuits consume power in relation to the data values being processed then the power signature contains secret data in an encoded form. Given the algorithm being computed by a microprocessor or other secure device, the eavesdropper can construct a set of input stimuli to obtain a corresponding set of power traces which can be used to extract the secret information [8].
A related threat to smartcard systems is direct physical attack. The card's packaging is removed and the signals on the bus, or elsewhere in the processor, are read out using microprobes [9]. This step is typically used against some samples of the card to extract the card's software; once this has been done, an attack using power analysis can be devised which will work against other cards of the same type without the need to depackage them. A particularly grave threat is that such an attack might be implemented in a seemingly innocuous terminal, in which members of the public might insert smartcards issued by a bank or government in order to obtain some low cost service. For example, a criminal gang might set up a market stall and sell goods, but with the real intention of obtaining cardholders' private or secret keys and thus forging smartcards which would later be used to loot their accounts or impersonate them for welfare and other claims.
Another threat to smartcard systems is fault induction. Faults can be induced in a number of ways, such as by introducing transients (‘glitches’) on the power and clock lines [14, 1]. These may cause the processor to malfunction in a predictable and useful way. Another attack technique, used in the context of an invasive microprobing attack, is to use a laser to shoot away alarm circuitry, or protective circuitry such as access control matrices which only allow certain areas of memory to be accessed following the presentation of certain passwords [9]. In order to ensure that the failure of a single circuit element (such as a wire or transistor) cannot cause secret data to be leaked, some manufacturers of defence electronic equipment use two-wire logic, that is, logic in which each state is carried on two wires with ‘01’ meaning ‘0’ and ‘10’ meaning ‘1’. To date, such circuits appear to have used clocked rather than self-timed logic. As well as measuring the current drawn by the secure device, an attacker can also measure the time taken for a cryptographic or other computation to execute [6]. We will consider this to be a special case of power analysis.
Existing defensive technology includes randomised internal clock generators to deny precise timing information to an attacker [14], incorporating a number of oscillators and/or noise generators to provide masking signals, physical chip coatings to make probing more difficult, sensor grids in the top metal layer of the chip which may be broken during probing attacks and activate alarms [9], and mechanisms whereby a random input may be used to make a processor execute equivalent sequences of instruction cycles, or insert nulls (no-ops) into the instruction execution sequence [10.]
A secure device must therefore be protected in a number of ways. Noninvasive attacks based on power analysis must be made difficult, and to hinder attacks based on some combination of probing out the contents of a chip, inducing faults (whether by applied glitches or by invasive destructive methods such as laser shots), and power analysis, the circuit must also be highly resistant to electromagnetic transients while being able to propagate alarms quickly in the event of an attack being detected. This combination of robustness and fragility has been very hard to achieve with existing silicon technology.